VSCode: "Session ID required in mcp-session-id header" #239

Activity

1. cyberkaida commented on Dec 24, 2025

   

   cyberkaida

   on Dec 24, 2025

   Last edited by cyberkaida

   Owner

   More actions

   In your log it says it is trying to fall back to SSE, I am not sure why it is trying this. It is saying it is falling back but missing the header streaming HTTP requires. ReVa is serving Streaming HTTP and VSCode is trying SSE.

   ---

   The SSE transport was deprecated.
   https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#backwards-compatibility

   VSCode documentation says "legacy" support is included:
   https://code.visualstudio.com/docs/copilot/customization/mcp-servers#_http-and-serversent-events-sse-servers
2. cyberkaida

   self-assigned this

   on Dec 24, 2025
3. cyberkaida

   added

   bugSomething isn't workingSomething isn't working

   Ghidra🐉 - Related to the Ghidra extension🐉 - Related to the Ghidra extension

   on Dec 24, 2025
4. DaCodeChick commented on Dec 25, 2025

   

   DaCodeChick

   on Dec 25, 2025

   Author

   More actions

   This is how it's set up currently in mcp.json:

   "ReVa": {
   	"url": "http://localhost:8080/mcp/message",
   	"type": "http"
   }
   
5. karliky commented on Jan 4, 2026

   

   karliky

   on Jan 4, 2026

   More actions

   I have the exact same problem, my mpc config:

   {
     "servers": {
       "ReVa Assistant": {
         "type": "http",
         "url": "http://localhost:8080/mcp/message"
       }
     },
     "inputs": []
   }
   
   
6. karliky commented on Jan 4, 2026

   

   karliky

   on Jan 4, 2026

   Last edited by karliky

   More actions

   Took me a lot of time but I finally tracked down what’s actually going on, and it’s not SSE and not a VS Code config problem.

   The root cause is a protocol mismatch between newer VS Code MCP clients and the MCP Java SDK ReVa is using.

   Recent VS Code versions send a newer initialize payload that includes fields under:

   params.capabilities.elicitation.form
   

   The MCP Java SDK currently used by ReVa doesn’t recognize that field and fails JSON deserialization, returning a 400 during initialize with errors like:

   Invalid message format: Unrecognized field "form"
   (class McpSchema$ClientCapabilities$Elicitation)
   

   Once VS Code sees a 400 during Streamable HTTP startup, it automatically falls back to legacy SSE. That fallback then fails because ReVa correctly expects Streamable HTTP + a valid session ID, which is why everyone sees:

   Session ID required in mcp-session-id header
   

   So that error is just a symptom, not the real problem.

   I confirmed this by running a small proxy that strips capabilities.elicitation out of the initialize request before it reaches ReVa. With that one change, everything works immediately, no 400s, no SSE fallback, normal Streamable HTTP session.

   ReVa needs to update its MCP Java SDK (or relax JSON parsing):

   • Upgrade to a newer io.modelcontextprotocol Java SDK that supports the newer MCP spec fields
   • OR mark capability models to ignore unknown fields (@JsonIgnoreProperties(ignoreUnknown = true))

   Either of those fixes this cleanly and keeps ReVa forward-compatible with newer MCP clients.

   I confirmed this by running this script, which acts like a middleware:

   const http = require("http");
   
   const LISTEN_HOST = "127.0.0.1";
   const LISTEN_PORT = 18080;
   
   const TARGET_HOST = "127.0.0.1";
   const TARGET_PORT = 8080;
   const TARGET_PATH = "/mcp/message";
   
   let sessionId = null;
   let initializing = null;
   
   function ts() {
     return new Date().toISOString();
   }
   function log(...args) {
     console.log(ts(), ...args);
   }
   
   function pickHeader(headers, name) {
     const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
     return key ? headers[key] : undefined;
   }
   function setHeader(headers, name, value) {
     for (const k of Object.keys(headers)) {
       if (k.toLowerCase() === name.toLowerCase()) delete headers[k];
     }
     headers[name] = value;
   }
   
   function normalizeAccept(method, headers) {
     if (method === "GET") setHeader(headers, "Accept", "text/event-stream");
     else setHeader(headers, "Accept", "application/json, text/event-stream");
   }
   
   function normalizeOutgoingHeaders(method, incomingHeaders, extraHeaders = {}) {
     const headers = { ...incomingHeaders, ...extraHeaders };
   
     delete headers.host;
     delete headers.connection;
     delete headers["content-length"];
   
     normalizeAccept(method, headers);
   
     if (method !== "GET") {
       if (!pickHeader(headers, "Content-Type")) setHeader(headers, "Content-Type", "application/json");
     }
     return headers;
   }
   
   function readRequestBody(req) {
     return new Promise((resolve) => {
       const chunks = [];
       req.on("data", (c) => chunks.push(c));
       req.on("end", () => resolve(Buffer.concat(chunks)));
     });
   }
   
   function parseJsonSafe(buf) {
     try {
       return JSON.parse(buf.toString("utf8"));
     } catch {
       return null;
     }
   }
   
   /**
    * Sanitize VS Code's initialize payload so older MCP Java SDKs (like ReVa's) don't 400.
    * The observed offending field is: params.capabilities.elicitation.form
    * Safest: remove entire `elicitation` capability block.
    */
   function sanitizeInitialize(bodyBuffer) {
     const j = parseJsonSafe(bodyBuffer);
     if (!j || j.method !== "initialize") return bodyBuffer;
   
     const caps = j?.params?.capabilities;
     if (caps && typeof caps === "object") {
       // Remove unsupported capability block that triggers "Unrecognized field 'form' ... Elicitation"
       if (caps.elicitation) delete caps.elicitation;
   
       // (Optional safety) If VS Code adds other unknown nested fields later, you can strip here too.
       // e.g. delete caps.someFutureCapability;
     }
   
     return Buffer.from(JSON.stringify(j), "utf8");
   }
   
   function requestUpstream({ method, headers, bodyBuffer }) {
     return new Promise((resolve, reject) => {
       const opts = { host: TARGET_HOST, port: TARGET_PORT, path: TARGET_PATH, method, headers };
       const upstreamReq = http.request(opts, (upstreamRes) => resolve({ upstreamRes }));
       upstreamReq.on("error", reject);
       if (bodyBuffer && bodyBuffer.length) upstreamReq.write(bodyBuffer);
       upstreamReq.end();
     });
   }
   
   async function readUpstreamBody(upstreamRes, limitBytes = 256 * 1024) {
     return new Promise((resolve) => {
       const chunks = [];
       let total = 0;
       upstreamRes.on("data", (c) => {
         if (total < limitBytes) {
           const slice = c.slice(0, limitBytes - total);
           chunks.push(slice);
           total += slice.length;
         }
       });
       upstreamRes.on("end", () => resolve(Buffer.concat(chunks)));
     });
   }
   
   async function ensureSession() {
     if (sessionId) return sessionId;
     if (initializing) return initializing;
   
     initializing = (async () => {
       log("[proxy] initializing MCP session…");
   
       const initBody = Buffer.from(
         JSON.stringify({
           jsonrpc: "2.0",
           id: 1,
           method: "initialize",
           params: {
             protocolVersion: "2024-11-05",
             capabilities: {},
             clientInfo: { name: "vscode-proxy", version: "1.0" },
           },
         }),
         "utf8"
       );
   
       const headers = normalizeOutgoingHeaders("POST", {
         "Content-Type": "application/json",
       });
   
       const { upstreamRes } = await requestUpstream({ method: "POST", headers, bodyBuffer: initBody });
       const bodyBuf = await readUpstreamBody(upstreamRes);
   
       const sid = pickHeader(upstreamRes.headers, "mcp-session-id");
       log("[proxy] initialize upstream status =", upstreamRes.statusCode, "sid =", sid || "(none)");
   
       if (!sid) {
         const preview = bodyBuf.toString("utf8").slice(0, 2000);
         throw new Error(`No Mcp-Session-Id from ReVa. status=${upstreamRes.statusCode} body=${preview}`);
       }
   
       sessionId = sid;
       return sessionId;
     })();
   
     try {
       return await initializing;
     } finally {
       initializing = null;
     }
   }
   
   function isInitializeRequest(bodyBuffer) {
     const j = parseJsonSafe(bodyBuffer);
     return !!(j && j.method === "initialize");
   }
   
   async function forwardStreaming(clientReq, clientRes, bodyBuffer, extraHeaders = {}) {
     const headers = normalizeOutgoingHeaders(clientReq.method, clientReq.headers, extraHeaders);
   
     const sidPresent =
       !!pickHeader(headers, "mcp-session-id") || !!pickHeader(headers, "Mcp-Session-Id");
   
     const shortBody =
       bodyBuffer && bodyBuffer.length ? bodyBuffer.toString("utf8").slice(0, 200).replace(/\s+/g, " ") : "";
   
     log(
       `[proxy] IN  ${clientReq.method} ${clientReq.url} sid=${sidPresent} accept="${clientReq.headers.accept || ""}" body="${shortBody}"`
     );
     log(
       `[proxy] ->  ${clientReq.method} ${TARGET_PATH} acceptSent="${pickHeader(headers, "accept") || ""}"`
     );
   
     const { upstreamRes } = await requestUpstream({
       method: clientReq.method,
       headers,
       bodyBuffer,
     });
   
     const upstreamSid = pickHeader(upstreamRes.headers, "mcp-session-id");
     if (upstreamSid) sessionId = upstreamSid;
   
     log(`[proxy] <-  status=${upstreamRes.statusCode}`);
   
     clientRes.writeHead(upstreamRes.statusCode || 500, upstreamRes.headers);
     upstreamRes.pipe(clientRes);
   }
   
   async function forwardInitializeWithRetry(clientReq, clientRes, bodyBuffer) {
     const sanitizedBody = sanitizeInitialize(bodyBuffer);
   
     // 1) Try forwarding sanitized initialize as-is
     const headers1 = normalizeOutgoingHeaders("POST", clientReq.headers);
     log(`[proxy] INIT try#1 -> POST ${TARGET_PATH} acceptSent="${pickHeader(headers1, "accept")}"`);
   
     const { upstreamRes: res1 } = await requestUpstream({
       method: "POST",
       headers: headers1,
       bodyBuffer: sanitizedBody,
     });
   
     const buf1 = await readUpstreamBody(res1);
     const maybeMsg1 = (() => {
       const j = parseJsonSafe(buf1);
       return j && (j.message || j.localizedMessage);
     })();
   
     log(`[proxy] INIT try#1 <- status=${res1.statusCode} msg="${(maybeMsg1 || "").slice(0, 200)}"`);
   
     // If OK, return it to client
     if ((res1.statusCode || 0) < 400) {
       clientRes.writeHead(res1.statusCode || 200, res1.headers);
       clientRes.end(buf1);
       return;
     }
   
     // 2) If still failing, obtain a session and retry initialize WITH Mcp-Session-Id
     const sid = await ensureSession();
   
     const headers2 = normalizeOutgoingHeaders("POST", clientReq.headers, { "Mcp-Session-Id": sid });
     log(`[proxy] INIT try#2 -> POST ${TARGET_PATH} sid=${sid}`);
   
     const { upstreamRes: res2 } = await requestUpstream({
       method: "POST",
       headers: headers2,
       bodyBuffer: sanitizedBody,
     });
   
     const buf2 = await readUpstreamBody(res2);
     const maybeMsg2 = (() => {
       const j = parseJsonSafe(buf2);
       return j && (j.message || j.localizedMessage);
     })();
   
     log(`[proxy] INIT try#2 <- status=${res2.statusCode} msg="${(maybeMsg2 || "").slice(0, 200)}"`);
   
     clientRes.writeHead(res2.statusCode || 500, res2.headers);
     clientRes.end(buf2);
   }
   
   const server = http.createServer(async (req, res) => {
     try {
       const bodyBuffer = await readRequestBody(req);
   
       // Always handle initialize with buffered retry logic (and sanitize)
       if (req.method === "POST" && isInitializeRequest(bodyBuffer)) {
         await forwardInitializeWithRetry(req, res, bodyBuffer);
         return;
       }
   
       // For everything else: ensure session if client didn't send one
       const hasSid = !!pickHeader(req.headers, "mcp-session-id");
       if (!hasSid) {
         const sid = await ensureSession();
         await forwardStreaming(req, res, bodyBuffer, { "Mcp-Session-Id": sid });
         return;
       }
   
       await forwardStreaming(req, res, bodyBuffer);
     } catch (e) {
       log("[proxy] ERROR", String(e));
       res.writeHead(502, { "content-type": "text/plain" });
       res.end(String(e));
     }
   });
   
   server.listen(LISTEN_PORT, LISTEN_HOST, () => {
     log(
       `MCP proxy listening on http://${LISTEN_HOST}:${LISTEN_PORT}/mcp/message -> http://${TARGET_HOST}:${TARGET_PORT}${TARGET_PATH}`
     );
   });
   
   

   Then I connected to it with this copilot mcp config:

   {
     "servers": {
       "ReVa Assistant": {
         "type": "http",
         "url": "http://localhost:18080/mcp/message"
       }
     },
     "inputs": []
   }
   
   

   Run it with node mcp.js
7. cyberkaida commented on Jan 5, 2026

   

   cyberkaida

   on Jan 5, 2026

   Owner

   More actions

   I wish MCP is versioned better 😢

   I will upgrade Java MCP and and do a release. Thank you so much @karliky 💜

   ❤️React with ❤️1Reacted by Carlos Hernández Gómez
8. karliky commented on Jan 5, 2026

   

   karliky

   on Jan 5, 2026

   More actions

   Thanks, I stopped using this MCP because it freezes my visual studio code while listing functions from the ghidra process.... but anyways, thanks!
9. cyberkaida commented on Jan 5, 2026

   

   cyberkaida

   on Jan 5, 2026

   Owner

   More actions

   I have made a new release, v7.1.0. This includes many MCP protocol improvements. Please try this release.

   I have included a new debug option to help with these issues. Please try enabling the Debug mode and the request logging in the ReVa settings (Project window, Edit -> Tool Options), trigger the bug and then create a debug capture (Project window, Tool -> ReVa). This will capture the information I need to debug issues like this.

   If VSCode freezes when listing functions, please create an issue @karliky and I will debug it.

   
10. cyberkaida

    pinned this issue on Jan 5, 2026
11. cyberkaida

    linked a pull request that will close this issuechore(deps): bump Jackson from 2.19.2 to 2.20.x #243on Jan 5, 2026
12. cyberkaida

    linked a pull request that will close this issuechore(deps): bump io.modelcontextprotocol.sdk:mcp-bom from 0.14.0 to 0.17.0 #232on Jan 5, 2026
13. cyberkaida commented on Jan 5, 2026

    

    cyberkaida

    on Jan 5, 2026

    Owner

    More actions

    This should be fixed in #232 #243 and release v7.1.0

    ❤️React with ❤️1Reacted by Carlos Hernández Gómez
14. cyberkaida

    closed this as completedon Jan 5, 2026
15. cyberkaida

    reopened this on Jan 7, 2026
16. cyberkaida

    marked this as blocked on Jan 7, 2026

    • InitializeRequest doesn't accept non-empty Elicitation, violating 2025-11-25 spec modelcontextprotocol/java-sdk#724
17. cyberkaida commented on Jan 7, 2026

    

    cyberkaida

    on Jan 7, 2026

    Owner

    More actions

    I thought they merged the fix. It has not been merged.

    ❤️React with ❤️1Reacted by Carlos Hernández Gómez
18. cyberkaida

    added a commit that references this issue on Jan 7, 2026

    Workaround for issue #239 and #249

    ...

    d178adf
19. cyberkaida

    closed this as completedin #250on Jan 7, 2026
20. cyberkaida

    unpinned this issue on Mar 15, 2026
21. VitorEAFeliciano

    added a commit that references this issue on Nov 14, 2026

    Workaround for issue cyberkaida#239 and cyberkaida#249

    ...

    55bfda0